Before you act

The computer is ON. What changes if you isolate it, maintain state, acquire live, or shut it down?

Evidence First begins from the observable state and compares realistic alternatives through what each action can preserve, lose, modify, endanger, or make difficult to reconstruct. The objective is not to prescribe a universal button to press, but to make the decision and its consequences explicit.

The method

01SCOPE
02OBSERVE
03OPTIONS
04GAIN
05LOSS
06FOOTPRINT
07RISK
08REVERSIBILITY
09DECIDE
10DOCUMENT

Product proof

State → options → consequences → documented decision.

The printed guide uses compact Decision Cards, Procedure Cards and State Maps. Gain, Loss, Footprint, Risk and Reversibility are made visible before DECIDE and DOCUMENT.

See what is included in Vol. 1 →

A02 · D1

Multiple Live Devices

FIRST RESPONSE
SITUATION

Two or more in-scope general-purpose computers are live at the same scene, but time, personnel, or acquisition capacity prevents treating all of them simultaneously.

Which computer must be handled first to avoid spending the most fragile or least reproducible evidence state?
OBSERVEDestructive activity?Unique unlocked state?Instability or imminent state loss?
OPTIONS & CONSEQUENCESPrioritize fragile stateParallelize with trained operatorsAvoid convenience-first ordering
DECIDEDOCUMENTGAIN · LOSS · FOOTPRINT · RISK · REVERSIBILITY

Publication status

Forthcoming · 2027 Edition

Retail links are intentionally not shown until confirmed listings are live. Companion resources, references, forms and the public card registry are already maintained at evidencefirst.guide.